diff options
| author | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2023-09-03 13:08:00 +0200 |
|---|---|---|
| committer | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2023-09-04 12:36:11 +0200 |
| commit | 5a8e3089b35e2eca2f896a01410fcdf6ac928278 (patch) | |
| tree | 6da06e30b55208af19126edfdd83b0677489284f /data/vyos-firewall-init.conf | |
| parent | 1ae9c4162dc13844ec0f028a51b4b2d111954196 (diff) | |
| download | vyos-1x-5a8e3089b35e2eca2f896a01410fcdf6ac928278.tar.gz vyos-1x-5a8e3089b35e2eca2f896a01410fcdf6ac928278.zip | |
conntrack: T4309: T4903: Refactor `system conntrack ignore` rule generation, add IPv6 support and firewall groups
Diffstat (limited to 'data/vyos-firewall-init.conf')
| -rw-r--r-- | data/vyos-firewall-init.conf | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/data/vyos-firewall-init.conf b/data/vyos-firewall-init.conf index 41e7627f5..768031c83 100644 --- a/data/vyos-firewall-init.conf +++ b/data/vyos-firewall-init.conf @@ -88,6 +88,8 @@ table ip6 raw { chain PREROUTING { type filter hook prerouting priority -300; policy accept; + counter jump VYOS_CT_IGNORE + counter jump VYOS_CT_TIMEOUT counter jump VYOS_CT_PREROUTING_HOOK counter jump FW_CONNTRACK notrack @@ -95,11 +97,40 @@ table ip6 raw { chain OUTPUT { type filter hook output priority -300; policy accept; + counter jump VYOS_CT_IGNORE + counter jump VYOS_CT_TIMEOUT counter jump VYOS_CT_OUTPUT_HOOK counter jump FW_CONNTRACK notrack } + ct helper rpc_tcp { + type "rpc" protocol tcp; + } + + ct helper rpc_udp { + type "rpc" protocol udp; + } + + ct helper tns_tcp { + type "tns" protocol tcp; + } + + chain VYOS_CT_HELPER { + ct helper set "rpc_tcp" tcp dport {111} return + ct helper set "rpc_udp" udp dport {111} return + ct helper set "tns_tcp" tcp dport {1521,1525,1536} return + return + } + + chain VYOS_CT_IGNORE { + return + } + + chain VYOS_CT_TIMEOUT { + return + } + chain VYOS_CT_PREROUTING_HOOK { return } |